PT-2023-4805 · Xwiki+1 · Xwiki+1

Michael Hamann · Published 2023-04-12 · Updated 2023-04-25 · CVE-2023-29209

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 13.10.11 XWiki versions prior to 14.4.7 XWiki versions prior to 14.10

Description The issue allows any user with view rights on commonly accessible documents, including the legacy notification activity macro, to execute arbitrary Groovy, Python, or Velocity code in XWiki, leading to full access to the XWiki installation. The root cause is improper escaping of the macro parameters of the legacy notification activity macro. This macro is installed by default in XWiki. The vulnerability can be exploited via every wiki page that is editable, including the user's profile, but also with just view rights using the HTMLConverter that is part of the CKEditor integration which is bundled with XWiki.

Recommendations For versions prior to 13.10.11, update to version 13.10.11 or later. For versions prior to 14.4.7, update to version 14.4.7 or later. For versions prior to 14.10, update to version 14.10 or later. As a temporary workaround, consider replacing the code of the legacy notification activity macro with the patched version or deleting the document XWiki.Notifications.Code.Legacy.ActivityMacro if the macro isn't used.

Exploit

Fix

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

Related Identifiers

BDU:2023-05268

CVE-2023-29209

GHSA-9PC2-X9QF-7J2Q

Affected Products

Ckeditor

Xwiki

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29209.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9pc2-x9qf-7j2q · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-20258 · Exploit
• https://github.com/xwiki/xwiki-platform/commit/94392490884635c028199275db059a4f471e57bc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-29209 · Security Note
• https://bdu.fstec.ru/vul/2023-05268 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29209 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9pc2-x9qf-7j2q · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cibsecurity/62231 · Telegram Post